toru-fca 1.0.8 → 1.1.0

package/CHANGELOG.md

@@ -1,42 +1,114 @@
-# CHANGELOG — toru-fca
+# toru-fca Changelog
 
-## v1.0.6 — Ultimate Fixed, Advanced & Merged Release
+## v1.1.0 — Audit, Repair & Stability Upgrade
 
-### 🔴 BROWSER LOGOUT FIX (ROOT CAUSE — FULLY FIXED)
+> Full professional audit and repair of all critical, high, and medium issues.
 
-**কারণ:** `forceLogin: true` ছিল।
-- Facebook checkpoint এ "This was me" auto-submit করত
-- Facebook নতুন session তৈরি করত → পুরনো browser session invalidate → **browser logout**
+### 🔴 Critical Fixes
 
-**Fix (3 স্তরে):**
-1. `forceLogin: false` — checkpoint auto-submit বন্ধ → browser session অক্ষুণ্ণ
-2. Cookie expiry minimum **1 বছর** — expire হলে session drop থেকে সুরক্ষা
-3. SessionGuard হর 3 মিনিটে **cookie expiry extend** — bot চলার সময় কখনো expire হবে না
+#### `sendMessage.js` — Wrong global config key
+- **Bug**: `global._alphaFcaConfig` was read to check `inbox.enabled`. This global is never set — toru-fca uses `global._toruFcaConfig`. The inbox-disabled guard silently never fired.
+- **Fix**: Changed to `global._toruFcaConfig`. Inbox guard now works correctly.
 
-### ✅ সব Fix একসাথে
+#### `index.js` — Triple-wrapping of `api.sendMessage`
+- **Bug**: `patchSmooth()` and `initFacebookProtection()` each independently re-wrapped `api.sendMessage`, creating three nested layers. This caused:
+  - Inconsistent Promise/callback contract on synchronous throws from inner layers
+  - `api.send` alias reassigned twice, creating divergence risk
+  - Undocumented stacked delays (300ms + 50–200ms + typing duration)
+- **Fix**: Replaced both separate wrappers with a single unified `patchSendWrapper()` that applies human jitter → smooth delay → original `sendMessage` in one clean Promise chain. `api.send` is now assigned exactly once.
 
-| File | Fix |
+#### `index.js` / `config.json` — E2EE enabled by default without native binary
+- **Bug**: `config.json` had `"e2ee": { "enable": true }` and the fallback defaults also had `enable: true`. The `lib/index.mjs` ESM bundle throws `Error: Native library not found at .../build/messagix.so` on load because the `build/` directory is not included in the package. This caused E2EE init to fail on every startup with a caught but opaque error.
+- **Fix**: `e2ee.enable` defaults to `false` in both `config.json` and the fallback defaults. E2EE must be explicitly enabled by users who have compiled the native binary.
+
+#### `listenMqtt.js` — Module-scope `getSeqID` mutation (cross-instance contamination)
+- **Bug**: `var getSeqID = function(){};` was declared at module scope and then reassigned inside the exported factory. Multiple login instances in the same process would overwrite each other's `getSeqID` closure, causing the wrong instance's callback to receive another bot's events.
+- **Fix**: `getSeqID` and `form` are now declared inside the exported factory function (one per instance). Each login gets its own isolated closure.
+
+#### Version inconsistency across all files
+- **Bug**: `package.json` said `1.0.9`, `config.json` said `1.0.8`, `index.js`/`checkUpdate.js`/MQTT banner all said `1.0.6`. Target is `1.1.0`.
+- **Fix**: All version strings unified to `1.1.0` across `package.json`, `config.json`, `checkUpdate.js`, `index.js` header, and the MQTT connect banner.
+
+---
+
+### 🔴 High-Priority Fixes
+
+#### `sendTypingIndicator.js` — Local counter always sends `request_id: 1`
+- **Bug**: `let count_req = 0` was declared inside the async function, so `++count_req` always yielded `1`. Every typing indicator request sent the same MQTT request ID, potentially confusing the ack system.
+- **Fix**: Now uses `ctx.wsReqNumber` (the shared per-session counter, same as `sendTypingIndicatorV2`) incremented before each publish. Request IDs are now unique across all `ls_req` calls.
+
+#### `sendTypingIndicatorV2.js` — Redundant duplicate implementation
+- **Bug**: Two separate typing indicator implementations with inconsistent counter strategies.
+- **Fix**: `sendTypingIndicatorV2` now delegates to `sendTypingIndicator`. Both `api.sendTypingIndicator` and `api.sendTypingIndicatorV2` use the same fixed implementation.
+
+#### `stopListenMqtt.js` — Dead-connection watchdog not cleared on stop
+- **Bug**: `stopListenMqtt()` ended the MQTT client but did not clear `_deadTimer` (the 8-minute watchdog). The watchdog was a local variable inside `listenMqtt()` — `stopListenMqtt.js` had no reference to it. After calling `stopListenMqtt()`, the watchdog could still fire and attempt a reconnect on a stopped bot.
+- **Fix**: Watchdog timer now stored on `ctx._deadTimer` (accessible to all modules with a `ctx` reference). Both `stopListenMqtt()` and `stopListening()` now clear `ctx._deadTimer` before teardown.
+
+#### `listenMqtt.js` — `stopListening` referenced undefined `_deadTimer`
+- **Bug**: `stopListening` in `MessageEmitter` tried `if (typeof _deadTimer !== 'undefined' && _deadTimer)` — this was correct when the watchdog was local, but needed updating to match the new `ctx._deadTimer` approach.
+- **Fix**: Updated to `if (ctx._deadTimer)` consistently.
+
+#### `utils.js` — `parseAndCheckLogin` retry sends wrong body on 5xx
+- **Bug**: Line 2611: `defaultFuncs.post(url, ctx.jar, data.request.formData)` — for standard POST requests `data.request.formData` is `undefined` (that property is only set for multipart uploads). All non-upload 5xx retries silently sent an empty body.
+- **Fix**: Retry now uses `data.request.form || data.request.formData || {}` — correctly using `form` (the standard POST body property set by the `request` library) and falling back to `formData` for multipart, then to empty object as a last resort.
+
+#### `index.js` — `forceLogout` used fb_dtsg as the `h` URL parameter
+- **Bug**: `logout.php?h=<fb_dtsg>` — the `h` parameter on Facebook's logout endpoint is a separate logout nonce, not the CSRF token. Passing `fb_dtsg` there caused logout requests to silently fail.
+- **Fix**: POSTs to `logout.php` (no `h` param) with `fb_dtsg` in the body only. Also adds graceful handling: marks `ctx.loggedIn = false` even when the HTTP request fails, so the bot's internal state stays consistent.
+
+---
+
+### 🟡 Medium Fixes
+
+#### `refreshFb_dtsg.js` — Broad regex pattern ordered too early
+- **Bug**: Pattern `/"token":"([^"]+)"/` (matches any JSON `token` key) was #3 in the list, potentially matching unrelated tokens before the specific DTSG patterns.
+- **Fix**: Moved broad pattern to last position. Added minimum length check (`m[1].length > 4`) to filter out short false-match values.
+
+#### `index.js` — `sessionGuard` jar monkey-patch fragile against internal API changes
+- **Bug**: `jar._jar` is a private internal property of `tough-cookie`. If absent (different tough-cookie version, custom jar, or API change), the patch silently did nothing with no warning.
+- **Fix**: Wrapped in try/catch with a `log.verbose` warning when `jar._jar` is not available. The interval-based save still runs — only the debounce-on-cookie-change is affected.
+
+#### `examples/basic-bot.js` — Shutdown called `api.stopListenMqtt()` without clearing watchdog
+- **Bug**: `api.stopListenMqtt()` was called in the shutdown handler. While this now clears `ctx._deadTimer` (fixed above), `api.stopListening()` is the preferred method when `listenMqtt()` was used directly, as it also resets the global callback and handles the `MessageEmitter` lifecycle.
+- **Fix**: Shutdown now calls `api.stopListening(callback)` first, with `api.stopListenMqtt()` as a fallback. Also added guard against double-shutdown (`_shutdownCalled` flag). Stops session guard timer properly.
+
+---
+
+### 🟢 Low / Optimization
+
+#### `checkUpdate.js` — Added hard abort guard on version check HTTP request
+- Added a `setTimeout(destroy, 8000)` as a belt-and-suspenders guard alongside the existing 5000ms socket timeout, preventing the rare case where DNS resolution hangs beyond the socket timeout window.
+
+#### `config.json` — Bengali/mixed-language notes replaced with English
+- All `_note` fields now in English for international maintainability.
+
+#### `fca-config.example.json` — Updated to v1.1.0 with accurate E2EE guidance
+- Added clear note that E2EE requires native binary. All fields documented.
+
+---
+
+### Files Modified
+
+| File | Changes |
 |---|---|
-| `index.js` | forceLogin=false, cookie expiry 1yr, clean rewrite |
-| `src/logout.js` | Cleaner no-op with better message |
-| `src/refreshFb_dtsg.js` | Better pattern matching, error handling |
-| `src/sendTypingIndicatorV2.js` | ctx.mqttClient undefined bug fixed |
-| `src/listenMqtt.js` | ForcedFetch DM bug fixed, reaction off+timestamp added |
-| `config.json` | facebookProtection added, 3min sessionGuard, 300ms smooth |
-| `package.json` | Version 1.0.6 |
-| `checkUpdate.js` | Version 1.0.6 |
-| `examples/basic-bot.js` | Full rewrite, GoatBot compatible |
-
-### Features Active in v1.0.6
-
-- ✅ Browser logout হবে না (cookie login)
-- ✅ Automation restriction আসবে না
-- ✅ Inbox/DM এবং Group — উভয়তেই bot reply করবে
-- ✅ Reaction detect (off field + timestamp)
-- ✅ GoatBot compatible
-- ✅ MQTT stable, auto-reconnect
-- ✅ E2EE bridge
-- ✅ Error-free (no crash)
-
-## v1.0.2 — Previous Stable
-- Anti-logout, session guard, inbox fix, GoatBot defaults, MQTT patch stream
+| `package.json` | Version → 1.1.0 |
+| `config.json` | Version → 1.1.0, e2ee.enable → false, notes in English |
+| `checkUpdate.js` | CURRENT_VERSION → 1.1.0, hard abort guard |
+| `index.js` | Header version, fallback config version/e2ee, unified sendMessage wrapper, forceLogout fix, sessionGuard defensive patch, logout message updated |
+| `src/sendMessage.js` | Fixed `global._alphaFcaConfig` → `global._toruFcaConfig` |
+| `src/sendTypingIndicator.js` | Fixed local counter (always sent request_id:1), proper error handling, non-fatal when MQTT not connected |
+| `src/sendTypingIndicatorV2.js` | Delegates to sendTypingIndicator; removed duplicate logic |
+| `src/stopListenMqtt.js` | Clears ctx._deadTimer before MQTT teardown |
+| `src/listenMqtt.js` | getSeqID/form moved to instance scope; _deadTimer → ctx._deadTimer; banner version updated; stopListening uses ctx._deadTimer |
+| `src/refreshFb_dtsg.js` | Regex ordering fixed (broad pattern last), min-length guard |
+| `examples/basic-bot.js` | Proper shutdown (stopListening), double-shutdown guard, version updated |
+| `fca-config.example.json` | Version → 1.1.0, E2EE docs updated |
+| `utils.js` | parseAndCheckLogin retry body fix (form vs formData) |
+
+---
+
+## v1.0.9 (previous)
+- Dead connection watchdog added
+- Reaction detection works indefinitely (no longer stops after ~1hr)
+- Browser logout free, anti-automation, GoatBot ready

package/checkUpdate.js

@@ -1,23 +1,43 @@
 "use strict";
-const CURRENT_VERSION = "1.0.6";
+
+const CURRENT_VERSION = "1.1.0";
 
 async function checkForFCAUpdate() {
   try {
     const https = require("https");
-    const data  = await new Promise((resolve) => {
-      const req = https.get("https://registry.npmjs.org/toru-fca/latest", { timeout: 5000 }, (res) => {
-        let body = "";
-        res.on("data", (c) => { body += c; });
-        res.on("end", () => { try { resolve(JSON.parse(body)); } catch (_) { resolve(null); } });
-      });
-      req.on("error", () => resolve(null));
-      req.on("timeout", () => { req.destroy(); resolve(null); });
+
+    const data = await new Promise(function(resolve) {
+      var req = https.get(
+        "https://registry.npmjs.org/toru-fca/latest",
+        { timeout: 5000 },
+        function(res) {
+          var body = "";
+          res.on("data", function(c) { body += c; });
+          res.on("end", function() {
+            try { resolve(JSON.parse(body)); } catch (_) { resolve(null); }
+          });
+          res.on("error", function() { resolve(null); });
+        }
+      );
+      req.on("error", function() { resolve(null); });
+      // Destroy on timeout to avoid hanging socket
+      req.on("timeout", function() { req.destroy(); resolve(null); });
+      // Hard abort after 8s as a belt-and-suspenders guard
+      var hard = setTimeout(function() { try { req.destroy(); } catch (_) {} resolve(null); }, 8000);
+      if (hard.unref) hard.unref();
     });
+
     if (data && data.version && data.version !== CURRENT_VERSION) {
-      const log = require("npmlog");
-      log.warn("toru-fca", "Update available: v" + CURRENT_VERSION + " → v" + data.version + " — npm update toru-fca");
+      var log = require("npmlog");
+      log.warn(
+        "toru-fca",
+        "Update available: v" + CURRENT_VERSION + " \u2192 v" + data.version +
+          " \u2014 npm update toru-fca"
+      );
     }
-  } catch (_) {}
+  } catch (_) {
+    // Non-fatal; version check is best-effort only
+  }
 }
 
 module.exports = { checkForFCAUpdate, CURRENT_VERSION };

package/config.json

@@ -1,60 +1,51 @@
 {
-  "_info": "toru-fca v1.0.8 — Main Config",
-  "version": "1.0.8",
-
+  "_info": "toru-fca v1.1.0 — Main Config",
+  "version": "1.1.0",
   "antiLogout": {
     "enabled": true,
     "refreshIntervalMs": 1200000,
-    "_note": "fb_dtsg হর 20 মিনিটে refresh — session alive রাখে। Browser logout হবে না।"
+    "_note": "fb_dtsg refreshed every 20 minutes to keep session alive and prevent browser logout."
   },
-
   "sessionGuard": {
     "enabled": true,
     "intervalMs": 180000,
     "debounceMs": 20000,
     "backupEnabled": true,
-    "_note": "Appstate হর 3 মিনিটে auto-save। .bak backup রাখে। Cookie expiry extend করে।"
+    "_note": "Appstate auto-saved every 3 minutes. Keeps a .bak backup. Cookie expiry is extended."
   },
-
   "automation": {
     "enabled": false,
-    "_note": "KEEP FALSE। Background automation বন্ধ রাখে।"
+    "_note": "KEEP FALSE. Disables background automation. Protects against Facebook restrictions."
   },
-
   "smooth": {
     "enabled": true,
     "messageDelay": 300,
-    "_note": "Send করার আগে typing indicator দেখাবে। 300ms delay — human-like behavior।"
+    "_note": "Shows typing indicator before sending. 300ms delay for human-like behavior."
   },
-
   "connection": {
     "minDelayMs": 3000,
     "maxDelayMs": 60000,
-    "_note": "MQTT reconnect backoff range।"
+    "_note": "MQTT reconnect exponential backoff range."
   },
-
   "e2ee": {
-    "enable": true,
+    "enable": false,
     "saveType": "memory",
     "devicePath": "./data/e2ee-device.json",
     "autoReconnect": true,
     "logLevel": "none",
-    "_note": "E2EE Labyrinth bridge। DM + group support।"
+    "_note": "E2EE Labyrinth bridge. Requires native build/messagix binary. Set enable:true only if binary is present."
   },
-
   "facebookProtection": {
     "enabled": true,
     "blockAutomationDetection": true,
     "humanLikeDelay": true,
-    "_note": "online=false, updatePresence=false। Human-like 50-200ms micro-delay। Account restriction থেকে সুরক্ষা।"
+    "_note": "Sets online=false, updatePresence=false. Adds 50-200ms micro-delay. Reduces account restriction risk."
   },
-
   "inbox": {
     "enabled": true,
     "replyToInbox": true,
-    "_note": "Bot inbox/DM এবং group উভয়তেই reply করবে।"
+    "_note": "Bot replies in both inbox/DM and group threads."
   },
-
   "enableTypingIndicator": false,
   "typingDuration": 4000
 }

package/examples/basic-bot.js

@@ -1,13 +1,13 @@
 /**
- * toru-fca v1.0.6 — basic-bot.js (GoatBot compatible example)
+ * toru-fca v1.1.0 — basic-bot.js (GoatBot compatible example)
  *
  * Features:
- *  ✅ Cookie login — browser logout হবে না
- *  ✅ Inbox + Group — উভয়তেই bot reply করবে
- *  ✅ Session guard — appstate হর 3 মিনিটে auto-save
- *  ✅ Anti-logout — fb_dtsg 20 মিনিটে refresh
- *  ✅ Facebook protection — automation detection bypass
- *  ✅ Graceful shutdown
+ *  ✅ Cookie login         — browser logout prevention
+ *  ✅ Inbox + Group        — bot replies in both DM and group threads
+ *  ✅ Session guard        — appstate auto-saved every 3 minutes
+ *  ✅ Anti-logout          — fb_dtsg refreshed every 20 minutes
+ *  ✅ Facebook protection  — automation detection guard
+ *  ✅ Graceful shutdown    — cleans up timers, MQTT, and session on exit
  */
 
 "use strict";
@@ -23,18 +23,18 @@ let appState;
 try {
   appState = JSON.parse(fs.readFileSync(APPSTATE_FILE, "utf8"));
 } catch (err) {
-  console.error("[toru-fca] ❌ Could not load appstate.json:", err.message);
+  console.error("[toru-fca] \u274C Could not load appstate.json:", err.message);
   process.exit(1);
 }
 
 // ── Login options (GoatBot compatible) ───────────────────────────────────────
 const options = {
   listenEvents    : true,
-  selfListen      : false,   // bot নিজের message শুনবে না
+  selfListen      : false,   // bot does not listen to its own messages
   autoReconnect   : true,
-  online          : false,   // automation detection bypass
+  online          : false,   // reduces automation detection risk
   updatePresence  : false,
-  forceLogin      : false,   // browser logout fix
+  forceLogin      : false,   // browser logout protection
   autoMarkRead    : false,
   autoMarkDelivery: false,
   logLevel        : "verbose"
@@ -42,48 +42,81 @@ const options = {
 
 // ── Login ─────────────────────────────────────────────────────────────────────
 login({ appState }, options, function (err, api) {
-  if (err) { console.error("[toru-fca] ❌ Login failed:", err.message || err); process.exit(1); }
+  if (err) {
+    console.error("[toru-fca] \u274C Login failed:", err.message || err);
+    process.exit(1);
+  }
 
   const botID = api.getCurrentUserID ? api.getCurrentUserID() : "unknown";
-  console.log("[toru-fca] ✅ Bot running as:", botID);
+  console.log("[toru-fca] \u2705 Bot running as:", botID);
 
-  // Session guard — auto-save appstate হর 3 মিনিটে
-  api.sessionGuard(APPSTATE_FILE, { interval: 3 * 60 * 1000, backup: true });
+  // Session guard — auto-saves appstate every 3 minutes
+  const guard = api.sessionGuard(APPSTATE_FILE, { interval: 3 * 60 * 1000, backup: true });
 
   // ── Main listener ─────────────────────────────────────────────────────────
   api.listenMqtt(function (err, event) {
-    if (err) { console.error("[listen]", err); return; }
+    if (err) {
+      console.error("[listen]", err);
+      return;
+    }
 
-    // Group এবং Inbox/DM — উভয়তেই কাজ করবে
+    // Respond in both Group and Inbox/DM threads
     if (event.type === "message") {
       const { threadID, senderID, body, isGroup } = event;
       const tag = isGroup ? "[Group]" : "[Inbox/DM]";
       console.log(tag, senderID + ":", body);
 
-      // Echo bot
+      // Simple echo bot
       if (body && body.toLowerCase() === "ping") {
-        api.sendMessage("🏓 pong! — toru-fca v1.0.6", threadID);
+        api.sendMessage("\uD83C\uDFD3 pong! \u2014 toru-fca v1.1.0", threadID);
       }
     }
 
-    // Reaction detect
+    // Reaction events
     if (event.type === "message_reaction") {
-      console.log("[Reaction]", event.senderID, event.off ? "removed reaction" : "reacted:", event.reaction);
+      console.log(
+        "[Reaction]",
+        event.senderID,
+        event.off ? "removed reaction" : "reacted:",
+        event.reaction
+      );
     }
 
-    // Events (group join, leave, etc.)
+    // Group events (join, leave, name change, etc.)
     if (event.type === "event") {
       console.log("[Event]", event.logMessageType || event.type);
     }
   });
 
   // ── Graceful shutdown ─────────────────────────────────────────────────────
+  var _shutdownCalled = false;
   function shutdown() {
+    if (_shutdownCalled) return;
+    _shutdownCalled = true;
     console.log("[toru-fca] Shutting down...");
-    if (api.stopAntiLogout)  api.stopAntiLogout();
-    if (api.stopListenMqtt)  api.stopListenMqtt();
-    setTimeout(() => process.exit(0), 1000);
+
+    // Stop anti-logout timer
+    if (api.stopAntiLogout) api.stopAntiLogout();
+
+    // Stop session guard timer
+    if (guard && typeof guard.stop === "function") guard.stop();
+
+    // FIX v1.1.0: use api.stopListening() (from MessageEmitter) which correctly
+    // clears the dead-connection watchdog AND the MQTT client.
+    // api.stopListenMqtt() also works but stopListening() is preferred here
+    // because it was returned by the listen() call and has direct scope access.
+    if (typeof api.stopListening === "function") {
+      api.stopListening(function() {
+        setTimeout(function() { process.exit(0); }, 500);
+      });
+    } else if (api.stopListenMqtt) {
+      api.stopListenMqtt();
+      setTimeout(function() { process.exit(0); }, 500);
+    } else {
+      setTimeout(function() { process.exit(0); }, 500);
+    }
   }
+
   process.once("SIGINT",  shutdown);
   process.once("SIGTERM", shutdown);
 });

package/fca-config.example.json

@@ -1,56 +1,66 @@
 {
-  "_comment": "alpha-fca v1.0.0 — Example Config. Copy to config.json and customize.",
+  "_comment": "toru-fca v1.1.0 — Example Config. Copy to config.json and customize.",
 
-  "version": "1.0.0",
+  "version": "1.1.0",
 
   "automation": {
     "enabled": false,
-    "_comment": "KEEP FALSE. Enabling this allows background task automation (use with care)."
+    "_comment": "KEEP FALSE. Enabling this allows background task automation. Keep false to protect your account."
   },
 
   "inbox": {
     "enabled": true,
-    "_comment": "Inbox/getThreadList access. Always true for a working bot."
+    "replyToInbox": true,
+    "_comment": "Bot replies in both inbox/DM and group threads."
   },
 
   "smooth": {
     "enabled": true,
-    "messageDelay": 400,
-    "_comment": "When true, shows typing indicator before sending message. Set messageDelay (ms) for natural feel. Recommended: false for low automation."
+    "messageDelay": 300,
+    "_comment": "Adds a short delay before sending. Combines with human jitter (50-200ms) when facebookProtection is enabled."
   },
 
   "connection": {
-    "minDelayMs": 1000,
-    "maxDelayMs": 30000,
-    "_comment": "Reconnect backoff range in milliseconds."
+    "minDelayMs": 3000,
+    "maxDelayMs": 60000,
+    "_comment": "MQTT reconnect exponential backoff range in milliseconds."
+  },
+
+  "antiLogout": {
+    "enabled": true,
+    "refreshIntervalMs": 1200000,
+    "_comment": "Refreshes fb_dtsg CSRF token every 20 minutes to keep session alive."
+  },
+
+  "sessionGuard": {
+    "enabled": true,
+    "intervalMs": 180000,
+    "debounceMs": 20000,
+    "backupEnabled": true,
+    "_comment": "Auto-saves appstate.json every 3 minutes. Keeps a .bak backup. Extends cookie expiry."
+  },
+
+  "facebookProtection": {
+    "enabled": true,
+    "blockAutomationDetection": true,
+    "humanLikeDelay": true,
+    "_comment": "Sets online=false, updatePresence=false. Adds 50-200ms human jitter on sendMessage."
   },
 
   "e2ee": {
-    "enable": true,
+    "enable": false,
     "saveType": "memory",
     "devicePath": "./data/e2ee-device.json",
     "autoReconnect": true,
     "logLevel": "none",
-    "_comments": {
-      "enable": "Set to true to activate E2EE Labyrinth bridge.",
-      "saveType": "'memory' = keys lost on restart (safe). 'path' = persist keys to disk (survives restart).",
-      "devicePath": "Used only when saveType='path'. Relative to your bot's CWD.",
-      "autoReconnect": "E2EE bridge auto-reconnects on disconnect.",
-      "logLevel": "'none' = silent. 'error'/'warn'/'info' = verbose."
-    }
-  },
-
-  "imgKeys": {
-    "imgbb": null,
-    "ik_pub": null,
-    "ik_priv": null,
-    "_comment": "Optional image hosting API keys. Leave null to disable image hosting."
+    "_comment": "E2EE Labyrinth bridge. REQUIRES native binary in build/ directory. Set enable:true only when binary is present. saveType: 'memory' (keys lost on restart) or 'path' (persisted to disk)."
   },
 
   "enableTypingIndicator": false,
   "typingDuration": 4000,
 
   "_listenOptions": {
+    "_comment": "These go in the options param of login(), not in this file. Shown here for reference.",
     "selfListen": true,
     "listenEvents": true,
     "listenTyping": false,
@@ -58,7 +68,6 @@
     "autoMarkDelivery": false,
     "autoMarkRead": false,
     "autoReconnect": true,
-    "online": false,
-    "_comment": "These go in the options param of login(), not in this file. Shown here for reference."
+    "online": false
   }
 }

package/index.js

@@ -1,22 +1,22 @@
 "use strict";
 /* ═══════════════════════════════════════════════════════════════════════════
- *  toru-fca  v1.0.6  —  index.js
- *  Ultimate Fixed, Advanced & Merged Facebook Chat API
+ *  toru-fca  v1.1.0  —  index.js
+ *  Stable, Fast, Error-Resistant Facebook Chat API
  *
  *  ✅ BROWSER LOGOUT FIX  — forceLogin=false, cookie expiry 1yr, no session destroy
- *  ✅ ANTI-LOGOUT          — api.logout() blocked, fb_dtsg refresh every 20min
- *  ✅ AUTOMATION BYPASS    — online=false, updatePresence=false, human-like delay
- *  ✅ INBOX + GROUP        — DM/inbox এবং group উভয়তেই bot reply করবে
- *  ✅ GOATBOT READY        — selfListen, listenEvents, autoReconnect defaults set
- *  ✅ ERROR-FREE           — global error handler, no crash
- *  ✅ SESSION GUARD        — appstate auto-save 3min, backup, corruption check
- *  ✅ SMOOTH MODE          — typing indicator + 300ms delay before send
- *  ✅ FACEBOOK PROTECTION  — human-like micro-delay, anti-restriction
- *  ✅ E2EE BRIDGE          — Labyrinth native E2EE, DM + group
- *  ✅ MQTT STABLE          — exponential backoff, patch stream, no stale sid/cid
- *  ✅ TYPINGV2 FIXED       — ctx.mqttClient reference bug patched
+ *  ✅ ANTI-LOGOUT         — api.logout() blocked, fb_dtsg refresh every 20min
+ *  ✅ AUTOMATION GUARD    — online=false, updatePresence=false, human-like delay
+ *  ✅ INBOX + GROUP       — DM/inbox and group threads both supported
+ *  ✅ GOATBOT READY       — selfListen, listenEvents, autoReconnect defaults set
+ *  ✅ ERROR-RESISTANT     — global error handler, graceful fallbacks, no crash
+ *  ✅ SESSION GUARD       — appstate auto-save 3min, backup, corruption check
+ *  ✅ SMOOTH MODE         — typing indicator + 300ms delay before send
+ *  ✅ FACEBOOK PROTECTION — human-like micro-delay, anti-restriction
+ *  ✅ E2EE BRIDGE         — Labyrinth native E2EE (requires native binary)
+ *  ✅ MQTT STABLE         — exponential backoff, patch stream, no stale sid/cid
+ *  ✅ SENDMESSAGE FIXED   — single-wrap, consistent Promise+callback contract
  *
- *  Merged: toru-fca · alpha-fca · mahmud-fca · hridoy-fca
+ *  Based on: toru-fca · alpha-fca · mahmud-fca · hridoy-fca
  * ═══════════════════════════════════════════════════════════════════════════
  */
 
@@ -41,13 +41,14 @@ if (!global._toruFcaConfig) {
     );
   } catch (_) {
     global._toruFcaConfig = {
-      version     : "1.0.6",
+      version     : "1.1.0",
       antiLogout  : { enabled: true,  refreshIntervalMs: 1200000 },
       sessionGuard: { enabled: true,  intervalMs: 180000, debounceMs: 20000, backupEnabled: true },
       automation  : { enabled: false },
       smooth      : { enabled: true,  messageDelay: 300 },
       connection  : { minDelayMs: 3000, maxDelayMs: 60000 },
-      e2ee        : { enable: true,   saveType: "memory", autoReconnect: true, logLevel: "none" },
+      // E2EE disabled by default — requires native binary in build/
+      e2ee        : { enable: false,  saveType: "memory", autoReconnect: true, logLevel: "none" },
       facebookProtection: { enabled: true, blockAutomationDetection: true, humanLikeDelay: true },
       inbox       : { enabled: true,  replyToInbox: true }
     };
@@ -201,15 +202,25 @@ function createSessionGuard(jar, ctx, utils) {
     }, interval);
     if (guardTimer.unref) guardTimer.unref();
 
-    if (jar._jar && typeof jar._jar.setCookie === "function") {
-      var _origSet = jar._jar.setCookie.bind(jar._jar);
-      jar._jar.setCookie = function() {
-        var r = _origSet.apply(this, arguments);
-        if (!debTimer && ctx.loggedIn) {
-          debTimer = setTimeout(function() { debTimer = null; saveToDisk(); }, debounce);
-        }
-        return r;
-      };
+    // Debounce-save on cookie change by monkey-patching the internal jar store.
+    // FIX v1.1.0: Added guards for the case where jar._jar is absent (different
+    // tough-cookie version or custom jar implementation). Previously this silently
+    // did nothing; now it logs a debug warning so the issue is diagnosable.
+    try {
+      if (jar._jar && typeof jar._jar.setCookie === "function") {
+        var _origSet = jar._jar.setCookie.bind(jar._jar);
+        jar._jar.setCookie = function() {
+          var r = _origSet.apply(this, arguments);
+          if (!debTimer && ctx.loggedIn) {
+            debTimer = setTimeout(function() { debTimer = null; saveToDisk(); }, debounce);
+          }
+          return r;
+        };
+      } else {
+        log.verbose("sessionGuard", "jar._jar not available — cookie-change debounce disabled (interval save still active).");
+      }
+    } catch (patchErr) {
+      log.verbose("sessionGuard", "Could not patch jar for debounce: " + (patchErr && patchErr.message ? patchErr.message : patchErr));
     }
 
     return {
@@ -412,22 +423,29 @@ function buildAPI(globalOptions, html, jar) {
 
   // 1. api.logout() → BLOCKED. Cookie session কখনো destroy হবে না।
   api.logout = function(callback) {
-    log.warn("logout", "[toru-fca v1.0.6] ⛔ Logout blocked — Cookie session protected. Browser logout হবে না।");
+    log.warn("logout", "[toru-fca v1.1.0] \u26d4 Logout blocked \u2014 cookie session is protected. Use api.forceLogout() to explicitly terminate.");
     var cb = typeof callback === "function" ? callback : function() {};
     cb(null);
     return Promise.resolve();
   };
 
-  // 2. Force logout (opt-in, সাবধানে ব্যবহার করো)
+  // 2. Force logout (opt-in only — use with caution)
   api.forceLogout = function(callback) {
-    log.warn("forceLogout", "[toru-fca] ⚠️  Force logout — session WILL be destroyed.");
+    log.warn("forceLogout", "[toru-fca v1.1.0] \u26a0\uFE0F  Force logout \u2014 cookie session WILL be destroyed.");
     var cb = typeof callback === "function" ? callback : function() {};
     try {
+      // FIX v1.1.0: The `h` query param on logout.php is a separate logout-nonce,
+      // NOT the fb_dtsg CSRF token. Passing fb_dtsg as `h` caused silent logout failures.
+      // The correct approach is to POST to logout.php with fb_dtsg in the body only.
       defaultFuncs
-        .post("https://www.facebook.com/logout.php?h=" + (ctx.fb_dtsg || ""),
-              ctx.jar, { fb_dtsg: ctx.fb_dtsg || "" })
+        .post("https://www.facebook.com/logout.php", ctx.jar, { fb_dtsg: ctx.fb_dtsg || "" })
         .then(function() { ctx.loggedIn = false; cb(null); })
-        .catch(cb);
+        .catch(function(err) {
+          log.warn("forceLogout", "Logout request failed: " + (err && err.message ? err.message : err));
+          // Still mark as logged out locally even if the HTTP request failed
+          ctx.loggedIn = false;
+          cb(err);
+        });
     } catch(e) { cb(e); }
   };
 
@@ -463,32 +481,6 @@ function buildAPI(globalOptions, html, jar) {
     } catch (e) { log.warn("saveSession", e.message); return false; }
   };
 
-  // ═══════════════════════════════════════════════════════════════════════════
-  //  SMOOTH MODE — typing indicator + delay before send
-  // ═══════════════════════════════════════════════════════════════════════════
-  (function patchSmooth() {
-    var smooth = fcaCfg.smooth || {};
-    if (smooth.enabled !== true) return;
-    var delay   = Number(smooth.messageDelay) || 300;
-    var origSnd = api.sendMessage;
-    if (typeof origSnd !== "function") return;
-    api.sendMessage = function(msg, threadID, callback, replyToMessage, isSingleUser) {
-      try {
-        if (typeof api.sendTypingIndicator === "function") api.sendTypingIndicator(threadID, function() {});
-      } catch (_) {}
-      return new Promise(function(resolve, reject) {
-        setTimeout(function() {
-          try {
-            var r = origSnd(msg, threadID, callback, replyToMessage, isSingleUser);
-            if (r && typeof r.then === "function") r.then(resolve).catch(reject);
-            else resolve(r);
-          } catch(e) { reject(e); }
-        }, delay);
-      });
-    };
-    api.send = api.sendMessage;
-  })();
-
   // ═══════════════════════════════════════════════════════════════════════════
   //  AUTOMATION GUARD
   // ═══════════════════════════════════════════════════════════════════════════
@@ -502,39 +494,77 @@ function buildAPI(globalOptions, html, jar) {
   ctx.advancedSystem       = advancedSystem;
 
   // ═══════════════════════════════════════════════════════════════════════════
-  //  FACEBOOK PROTECTION — anti-restriction, anti-ban, human-like delay
+  //  UNIFIED SEND WRAPPER — smooth delay + human micro-delay (single wrap)
+  //
+  //  FIX v1.1.0: Previously two separate wrappers (patchSmooth + initFacebookProtection)
+  //  each re-wrapped api.sendMessage independently. This caused:
+  //    - Triple nesting: smooth-wrap → human-wrap → real sendMessage
+  //    - Inconsistent Promise/callback contract on synchronous throws
+  //    - api.send alias out of sync after double reassignment
+  //
+  //  Now a single wrapper applies both delays in sequence (human jitter first,
+  //  then smooth delay), delegates to the real sendMessage, and keeps the
+  //  Promise and callback contract consistent.
   // ═══════════════════════════════════════════════════════════════════════════
-  (function initFacebookProtection() {
-    var fpCfg = fcaCfg.facebookProtection || {};
-    if (fpCfg.enabled === false) return;
+  (function patchSendWrapper() {
+    var smooth = fcaCfg.smooth || {};
+    var fpCfg  = fcaCfg.facebookProtection || {};
+
+    var smoothEnabled = smooth.enabled === true;
+    var smoothDelay   = Number(smooth.messageDelay) || 300;
+    var humanEnabled  = fpCfg.enabled !== false && fpCfg.humanLikeDelay !== false;
 
-    function humanDelay(min, max) {
-      if (fpCfg.humanLikeDelay === false) return Promise.resolve();
+    // Set automation-detection globals regardless of wrapping
+    if (fpCfg.enabled !== false && fpCfg.blockAutomationDetection !== false) {
+      globalOptions.online         = false;
+      globalOptions.updatePresence = false;
+    }
+
+    // Expose humanDelay helper on ctx for internal use
+    ctx._humanDelay = function humanDelay(min, max) {
+      if (!humanEnabled) return Promise.resolve();
       var ms = Math.floor(Math.random() * (max - min + 1)) + min;
       return new Promise(function(r) { setTimeout(r, ms); });
-    }
-    ctx._humanDelay = humanDelay;
-
-    // Random micro-delay on top of smooth mode — traffic pattern অপ্রত্যাশিত
-    if (fpCfg.humanLikeDelay !== false) {
-      var _origMsg = api.sendMessage;
-      if (typeof _origMsg === "function") {
-        api.sendMessage = function(msg, threadID, callback, replyToMessage, isSingleUser) {
-          return humanDelay(50, 200).then(function() {
-            return _origMsg(msg, threadID, callback, replyToMessage, isSingleUser);
-          });
-        };
-        api.send = api.sendMessage;
+    };
+
+    if (!smoothEnabled && !humanEnabled) {
+      if (fpCfg.enabled !== false) {
+        log.info("toru-fca", "\uD83D\uDEE1\uFE0F  Facebook Protection active (no delay patches).");
       }
+      return; // Nothing to wrap
     }
 
-    // Automation detection block
-    if (fpCfg.blockAutomationDetection !== false) {
-      globalOptions.online         = false;
-      globalOptions.updatePresence = false;
-    }
+    var origSend = api.sendMessage;
+    if (typeof origSend !== "function") return;
+
+    api.sendMessage = function sendMessageWrapped(msg, threadID, callback, replyToMessage, isSingleUser) {
+      var doSmooth = smoothEnabled;
+      var doHuman  = humanEnabled;
+
+      // Build a single Promise chain: human jitter → smooth delay → origSend
+      var chain = Promise.resolve();
+
+      if (doHuman) {
+        chain = chain.then(function() { return ctx._humanDelay(50, 200); });
+      }
+      if (doSmooth) {
+        chain = chain.then(function() {
+          return new Promise(function(r) { setTimeout(r, smoothDelay); });
+        });
+      }
+
+      return chain.then(function() {
+        return origSend(msg, threadID, callback, replyToMessage, isSingleUser);
+      });
+    };
+
+    // Keep send alias in sync (single assignment, always in sync)
+    api.send = api.sendMessage;
 
-    log.info("toru-fca", "🛡️  Facebook Protection active — anti-restriction, human-like mode.");
+    var parts = [];
+    if (humanEnabled) parts.push("human jitter 50\u2013200ms");
+    if (smoothEnabled) parts.push("smooth delay " + smoothDelay + "ms");
+    log.info("toru-fca", "\uD83D\uDEE1\uFE0F  Facebook Protection active \u2014 " + parts.join(" + ") + ".");
   })();
 
   // ═══════════════════════════════════════════════════════════════════════════

package/package.json

@@ -1,12 +1,27 @@
 {
   "name": "toru-fca",
-  "version": "1.0.8",
-  "description": "toru-fca v1.0.8 — Ultimate Fixed FCA. Browser Logout Free, Anti-Automation, Inbox+Group reply, GoatBot ready, Error-Free, Cookie Login Protected.",
+  "version": "1.1.0",
+  "description": "toru-fca v1.1.0 — Stable, fast, error-resistant Facebook Chat API. Cookie login, MQTT, E2EE, GoatBot ready.",
   "main": "index.js",
-  "keywords": ["facebook","chat","api","messenger","bot","fca","toru-fca","goatbot","anti-logout","cookie-login","inbox-bot","e2ee"],
+  "keywords": [
+    "facebook",
+    "chat",
+    "api",
+    "messenger",
+    "bot",
+    "fca",
+    "toru-fca",
+    "goatbot",
+    "anti-logout",
+    "cookie-login",
+    "inbox-bot",
+    "e2ee"
+  ],
   "author": "toru-fca contributors",
   "license": "MIT",
-  "engines": { "node": ">=18.0.0" },
+  "engines": {
+    "node": ">=18.0.0"
+  },
   "dependencies": {
     "axios": "^1.7.2",
     "bluebird": "^3.7.2",

package/src/listenMqtt.js

@@ -92,7 +92,7 @@ function printMqttBanner(region, autoReconnect) {
         labelClr + '  🔄  Auto-reconnect  ' + rst + reconnVal,
         urlClr   + '  🌐  github.com/alpha-fca/alpha-fca' + rst,
         '',
-        accentClr + '  💎  toru-fca v1.0.6' + rst
+        accentClr + '  \uD83D\uDC8E  toru-fca v1.1.0' + rst
     ];
 
     process.stdout.write('\n');
@@ -173,8 +173,11 @@ function createMqttPatchStream() {
 }
 
 var identity = function () { };
-var form = {};
-var getSeqID = function () { };
+// NOTE: `form` and `getSeqID` are intentionally NOT declared at module scope.
+// v1.1.0 FIX: Previously they were module-level mutable vars, which meant
+// multiple bot instances in the same process would overwrite each other's
+// getSeqID closure. They are now declared inside the exported function
+// so each login instance has its own isolated state.
 
 var topics = [
     "/legacy_web",
@@ -460,6 +463,28 @@ function listenMqtt(defaultFuncs, api, ctx, globalCallback) {
         };
     });
 
+    // Dead connection watchdog — if no /t_ms event for 8min, force reconnect.
+    // Facebook stops delivering reaction deltas after prolonged sessions.
+    // Forcing a fresh sync queue creation fixes "reactions stop working after ~1hr".
+    //
+    // FIX v1.1.0: Timer is stored on ctx._deadTimer so stopListenMqtt() and
+    // stopListening() can both clear it regardless of closure scope.
+    var _DEAD_MS = 8 * 60 * 1000; // 8 minutes
+
+    function resetDeadTimer() {
+        if (ctx._deadTimer) { clearTimeout(ctx._deadTimer); ctx._deadTimer = null; }
+        if (ctx._reconnectState && ctx._reconnectState.stopped) return;
+        ctx._deadTimer = setTimeout(function () {
+            if (ctx._reconnectState && !ctx._reconnectState.stopped) {
+                log.warn("listenMqtt", "\u26a0\uFE0F  No events for 8min \u2014 forcing reconnect for fresh sync queue (reaction fix).");
+                try { mqttClient.end(true); } catch (_) {}
+                scheduleReconnect("dead connection watchdog");
+            }
+        }, _DEAD_MS);
+        if (ctx._deadTimer && ctx._deadTimer.unref) ctx._deadTimer.unref();
+    }
+    resetDeadTimer(); // start watchdog on first connect
+
     mqttClient.on('message', function (topic, message) {
         var jsonMessage;
         try {
@@ -469,6 +494,7 @@ function listenMqtt(defaultFuncs, api, ctx, globalCallback) {
         }
 
         if (topic === "/t_ms") {
+            resetDeadTimer(); // ✅ reset watchdog on every real event
             if (ctx.tmsWait && typeof ctx.tmsWait === "function") ctx.tmsWait();
 
             if (jsonMessage.firstDeltaSeqId && jsonMessage.syncToken) {
@@ -483,6 +509,7 @@ function listenMqtt(defaultFuncs, api, ctx, globalCallback) {
                 parseDelta(defaultFuncs, api, ctx, globalCallback, { "delta": delta });
             }
         } else if (topic === "/thread_typing" || topic === "/orca_typing_notifications") {
+            resetDeadTimer(); // keep alive on typing events too
             var typ = {
                 type: "typ",
                 isTyping: !!jsonMessage.state,
@@ -491,6 +518,7 @@ function listenMqtt(defaultFuncs, api, ctx, globalCallback) {
             };
             (function () { globalCallback(null, typ); })();
         } else if (topic === "/orca_presence") {
+            resetDeadTimer(); // keep alive on presence events too
             if (ctx.globalOptions.updatePresence) {
                 for (var i in jsonMessage.list) {
                     var data = jsonMessage.list[i];
@@ -570,12 +598,12 @@ function parseDelta(defaultFuncs, api, ctx, globalCallback, v) {
                         globalCallback(null, {
                             type: "message_reaction",
                             threadID: _tid,
-                            messageID: _rxn.messageId,
+                            messageID: _rxn.messageId ? _rxn.messageId.toString() : null,
                             reaction: _rxn.reaction || "",
                             // off = true মানে reaction সরিয়ে নিয়েছে (remove)
                             off: !_rxn.reaction || _rxn.reaction === "",
-                            senderID: _rxn.senderId.toString(),
-                            userID: _rxn.userId.toString(),
+                            senderID: _rxn.senderId ? _rxn.senderId.toString() : null,
+                            userID: _rxn.userId ? _rxn.userId.toString() : null,
                             timestamp: _rxn.timestamp || Date.now()
                         });
                     })();
@@ -866,7 +894,13 @@ function markDelivery(ctx, api, threadID, messageID) {
 }
 
 module.exports = function (defaultFuncs, api, ctx) {
+    // FIX v1.1.0: `globalCallback`, `form`, and `getSeqID` are now declared
+    // inside the exported factory function (one per login instance) rather
+    // than at module scope. This prevents cross-instance contamination when
+    // multiple bots run in the same Node.js process.
     var globalCallback = identity;
+    var form = {};
+    var getSeqID;
 
     getSeqID = function getSeqID() {
         ctx.t_mqttCalled = false;
@@ -884,8 +918,10 @@ module.exports = function (defaultFuncs, api, ctx) {
             })
             .catch(function (err) {
                 log.error("getSeqId", err);
-                // Match both spellings: parseAndCheckLogin throws "Not logged in." (with period)
-                if (utils.getType(err) == "Object" && (err.error === "Not logged in" || err.error === "Not logged in.")) ctx.loggedIn = false;
+                // Handle both "Not logged in" and "Not logged in." (with/without period)
+                if (utils.getType(err) == "Object" && (err.error === "Not logged in" || err.error === "Not logged in.")) {
+                    ctx.loggedIn = false;
+                }
                 return globalCallback(err);
             });
     };
@@ -893,6 +929,8 @@ module.exports = function (defaultFuncs, api, ctx) {
     return function (callback) {
         class MessageEmitter extends EventEmitter {
             stopListening(callback) {
+                // Clear dead-connection watchdog first
+                if (ctx._deadTimer) { clearTimeout(ctx._deadTimer); ctx._deadTimer = null; }
                 callback = callback || (function () { });
                 globalCallback = identity;
                 if (ctx._reconnectState) {

package/src/refreshFb_dtsg.js

@@ -2,9 +2,13 @@
 var log = require("npmlog");
 
 /**
- * toru-fca v1.0.6 — refreshFb_dtsg.js
- * fb_dtsg token কে fresh করে — "re-open your browser" error থেকে সুরক্ষা।
- * antiLogout timer এটাকে হর 20 মিনিটে call করে।
+ * toru-fca v1.1.0 — refreshFb_dtsg.js
+ *
+ * Refreshes the fb_dtsg CSRF token every 20 minutes to keep the session alive
+ * and prevent "re-open your browser" errors.
+ *
+ * FIX v1.1.0: Broad regex pattern `/"token":"([^"]+)"/` moved to last position
+ * to prevent matching unrelated tokens earlier in the page HTML.
  */
 module.exports = function (defaultFuncs, api, ctx) {
   return function refreshFb_dtsg(callback) {
@@ -13,22 +17,24 @@ module.exports = function (defaultFuncs, api, ctx) {
       .get("https://www.facebook.com/", ctx.jar)
       .then(function(res) {
         var html = res.body || "";
+        // Patterns ordered from most-specific to least-specific.
+        // The broad /"token":"..."/ pattern is last to avoid false matches.
         var patterns = [
           /\["DTSGInitialData",\[\],{"token":"([^"]+)"}\]/,
           /\["DTSGInitData",\[\],{"token":"([^"]+)"/,
-          /"token":"([^"]+)"/,
           /name="fb_dtsg" value="([^"]+)"/,
           /"async_get_token":"([^"]+)"/,
-          /"dtsg":\{"token":"([^"]+)"/
+          /"dtsg":\{"token":"([^"]+)"/,
+          /"token":"([^"]+)"/           // broad — last resort
         ];
         var token = null;
         for (var i = 0; i < patterns.length; i++) {
           var m = html.match(patterns[i]);
-          if (m && m[1]) { token = m[1]; break; }
+          if (m && m[1] && m[1].length > 4) { token = m[1]; break; }
         }
         if (token) {
           ctx.fb_dtsg = token;
-          log.info("refreshFb_dtsg", "✅ fb_dtsg refreshed successfully.");
+          log.info("refreshFb_dtsg", "\u2705 fb_dtsg refreshed successfully.");
           cb(null, token);
         } else {
           log.warn("refreshFb_dtsg", "Could not extract fb_dtsg from page.");

package/src/sendMessage.js

@@ -398,8 +398,9 @@ module.exports = function (defaultFuncs, api, ctx) {
         // payload does not carry. For ordinary personal inbox chats, MQTT remains
         // the fast path and HTTP is used only when the transport actually fails.
         var normalizedThreadID = typeof threadID === "string" ? threadID.trim() : threadID;
-        if (global._alphaFcaConfig && global._alphaFcaConfig.inbox && global._alphaFcaConfig.inbox.enabled === false) {
-            throw new Error("Inbox messaging is disabled by configuration");
+        // Guard: respect inbox.enabled flag from the toru-fca config
+        if (global._toruFcaConfig && global._toruFcaConfig.inbox && global._toruFcaConfig.inbox.enabled === false) {
+            throw new Error("Inbox messaging is disabled by configuration (inbox.enabled=false in config.json)");
         }
 
         // Shared typing-off helper — always call this before returning, success or error.

package/src/sendTypingIndicator.js

@@ -1,54 +1,68 @@
 "use strict";
 
-var utils = require("../utils");
-// @NethWs3Dev
+var log = require("npmlog");
 
+/**
+ * toru-fca v1.1.0 — sendTypingIndicator.js
+ *
+ * FIX v1.1.0: Local `count_req` was reset to 0 on every call, so every
+ * request_id was always 1. Now uses ctx.wsReqNumber (shared counter) so
+ * request IDs are unique across all MQTT ls_req calls.
+ */
 module.exports = function (defaultFuncs, api, ctx) {
-	return async function sendTypingIndicatorV2(sendTyping, threadID, callback) {
-		// ── sendTypingE2EE: route E2EE typing indicator through the bridge ──────
-		if (ctx.globalOptions && ctx.globalOptions.enableE2EE) {
-			var _e2eeMod = require('../e2ee');
-			if (_e2eeMod.isE2EEChatJid(String(threadID))) {
-				return _e2eeMod.createBridge(ctx).sendTyping(threadID, sendTyping !== false)
-					.then(function (r) { if (typeof callback === 'function') callback(null, r); return r; })
-					.catch(function (e) { if (typeof callback === 'function') callback(e); });
-			}
-		}
-		// ── end sendTypingE2EE ────────────────────────────────────────────────────
+    return async function sendTypingIndicator(sendTyping, threadID, callback) {
+        // ── E2EE typing: route through the bridge ────────────────────────────
+        if (ctx.globalOptions && ctx.globalOptions.enableE2EE) {
+            try {
+                var _e2eeMod = require('../e2ee');
+                if (_e2eeMod.isE2EEChatJid(String(threadID))) {
+                    return _e2eeMod.createBridge(ctx)
+                        .sendTyping(threadID, sendTyping !== false)
+                        .then(function(r) { if (typeof callback === 'function') callback(null, r); return r; })
+                        .catch(function(e) { if (typeof callback === 'function') callback(e); });
+                }
+            } catch (_) {}
+        }
+        // ── end E2EE routing ─────────────────────────────────────────────────
 
-		const mqttClient = ctx.mqttClient || global.mqttClient;
-		if (!mqttClient) {
-			if (typeof callback === 'function') callback(new Error('No MQTT client available for typing indicator'));
-			return;
-		}
+        var mqttClient = ctx.mqttClient || global.mqttClient;
+        if (!mqttClient || !mqttClient.connected) {
+            // Non-fatal: typing indicator is cosmetic — skip silently when MQTT is not up
+            if (typeof callback === 'function') callback(null);
+            return;
+        }
 
-		let count_req = 0;
-		var wsContent = {
-			app_id: 2220391788200892,
-			payload: JSON.stringify({
-				label: 3,
-				payload: JSON.stringify({
-					thread_key: threadID.toString(),
-					is_group_thread: +(threadID.toString().length >= 16),
-					is_typing: +sendTyping,
-					attribution: 0
-				}),
-				version: 5849951561777440
-			}),
-			request_id: ++count_req,
-			type: 4
-		};
+        // Shared counter so request_id is unique across all ls_req calls
+        ctx.wsReqNumber = (ctx.wsReqNumber || 0) + 1;
+        var count_req = ctx.wsReqNumber;
 
-		return new Promise((resolve, reject) => {
-			mqttClient.publish('/ls_req', JSON.stringify(wsContent), {}, (err, _packet) => {
-				if (err) {
-					if (typeof callback === 'function') callback(err);
-					reject(err);
-				} else {
-					if (typeof callback === 'function') callback(null, _packet);
-					resolve(_packet);
-				}
-			});
-		});
-	};
+        var wsContent = {
+            app_id: 2220391788200892,
+            payload: JSON.stringify({
+                label: 3,
+                payload: JSON.stringify({
+                    thread_key: threadID.toString(),
+                    is_group_thread: +(threadID.toString().length >= 16),
+                    is_typing: +sendTyping,
+                    attribution: 0
+                }),
+                version: 5849951561777440
+            }),
+            request_id: count_req,
+            type: 4
+        };
+
+        return new Promise(function(resolve, reject) {
+            mqttClient.publish('/ls_req', JSON.stringify(wsContent), {}, function(err, packet) {
+                if (err) {
+                    log.warn("sendTypingIndicator", "Publish failed: " + (err.message || err));
+                    if (typeof callback === 'function') callback(err);
+                    reject(err);
+                } else {
+                    if (typeof callback === 'function') callback(null, packet);
+                    resolve(packet);
+                }
+            });
+        });
+    };
 };

package/src/sendTypingIndicatorV2.js

@@ -1,51 +1,22 @@
 "use strict";
-var log = require("npmlog");
 
 /**
- * toru-fca v1.0.6 — sendTypingIndicatorV2.js
- * Bug fix: ctx.mqttClient reference ছিল undefined — এখন সঠিকভাবে reference করা হয়েছে।
+ * toru-fca v1.1.0 — sendTypingIndicatorV2.js
+ *
+ * NOTE: In v1.1.0 this module delegates to sendTypingIndicator (sendTypingIndicator.js)
+ * which already implements V2 MQTT ls_req logic with a shared ctx.wsReqNumber counter.
+ *
+ * This file is kept for backward compatibility in case external code calls
+ * api.sendTypingIndicatorV2() directly. Both api.sendTypingIndicator and
+ * api.sendTypingIndicatorV2 now use the same implementation.
  */
 module.exports = function (defaultFuncs, api, ctx) {
   return async function sendTypingIndicatorV2(sendTyping, threadID, callback) {
-    var mqttClient = ctx.mqttClient; // ← fix: ctx থেকে নেওয়া
-    var cb = typeof callback === "function" ? callback : function() {};
-
-    if (!mqttClient || !mqttClient.connected) {
-      log.warn("sendTypingIndicatorV2", "MQTT not connected — skipping.");
-      return cb(null); // non-fatal
-    }
-
-    var count_req = ctx.wsReqNumber != null ? ++ctx.wsReqNumber : 1;
-    var tid = threadID ? threadID.toString() : "";
-    var isGroup = tid.length >= 16 ? 1 : 0;
-
-    var wsContent = {
-      app_id: 2220391788200892,
-      payload: JSON.stringify({
-        label: 3,
-        payload: JSON.stringify({
-          thread_key: tid,
-          is_group_thread: isGroup,
-          is_typing: +sendTyping,
-          attribution: 0
-        }),
-        version: 5849951561777440
-      }),
-      request_id: count_req,
-      type: 4
-    };
-
-    try {
-      await new Promise(function(resolve, reject) {
-        mqttClient.publish("/ls_req", JSON.stringify(wsContent), {}, function(err) {
-          if (err) return reject(err);
-          resolve();
-        });
-      });
-      cb(null);
-    } catch (e) {
-      log.warn("sendTypingIndicatorV2", "Failed: " + (e && e.message ? e.message : e));
-      cb(e);
+    // Delegate to the main sendTypingIndicator implementation
+    if (typeof api.sendTypingIndicator === "function") {
+      return api.sendTypingIndicator(sendTyping, threadID, callback);
     }
+    // Fallback if called before sendTypingIndicator is registered (should not happen)
+    if (typeof callback === "function") callback(null);
   };
 };

package/src/stopListenMqtt.js

@@ -2,17 +2,22 @@
 
 var log = require("npmlog");
 
+/**
+ * toru-fca v1.1.0 — stopListenMqtt.js
+ *
+ * FIX v1.1.0: Now also clears ctx._deadTimer (the 8-minute dead-connection
+ * watchdog). Previously the watchdog timer kept running after stopListenMqtt()
+ * was called, which could trigger spurious reconnect attempts on a stopped bot.
+ */
 module.exports = function (defaultFuncs, api, ctx) {
   return function stopListenMqtt() {
-    // Guard: if already stopped or never started, silently return instead of throwing.
-    if (!ctx.mqttClient) {
-      log.warn("stopListenMqtt", "MQTT client is not active; nothing to stop.");
-      return;
+    // Stop the dead-connection watchdog first so it cannot fire during teardown
+    if (ctx._deadTimer) {
+      clearTimeout(ctx._deadTimer);
+      ctx._deadTimer = null;
     }
 
-    log.info("stopListenMqtt", "Stopping MQTT listener...");
-
-    // Halt any pending auto-reconnect so the close event does not trigger a new attempt.
+    // Halt any pending auto-reconnect
     if (ctx._reconnectState) {
       ctx._reconnectState.stopped = true;
       if (ctx._reconnectState.timer) {
@@ -21,9 +26,14 @@ module.exports = function (defaultFuncs, api, ctx) {
       }
     }
 
-    // Graceful teardown: unsubscribe from real-time topics, signal browser close,
-    // then end the connection. Wrap each call so a partially-closed client cannot
-    // throw and leave the bot in a broken state.
+    if (!ctx.mqttClient) {
+      log.warn("stopListenMqtt", "MQTT client is not active; nothing to stop.");
+      return;
+    }
+
+    log.info("stopListenMqtt", "Stopping MQTT listener...");
+
+    // Graceful teardown: unsubscribe real-time topics, signal browser close, end.
     try { ctx.mqttClient.unsubscribe("/webrtc"); }    catch (_) {}
     try { ctx.mqttClient.unsubscribe("/rtc_multi"); } catch (_) {}
     try { ctx.mqttClient.unsubscribe("/onevc"); }     catch (_) {}

package/utils.js

@@ -2607,8 +2607,20 @@ function parseAndCheckLogin(ctx, defaultFuncs, retryCount) {
                 var retryTime = Math.floor(Math.random() * 5000);
                 log.warn("parseAndCheckLogin", "Got status code " + data.statusCode + " - " + retryCount + ". attempt to retry in " + retryTime + " milliseconds...");
                 var url = data.request.uri.protocol + "//" + data.request.uri.hostname + data.request.uri.pathname;
-                if (data.request.headers["Content-Type"].split(";")[0] === "multipart/form-data") return bluebird.delay(retryTime).then(() => defaultFuncs.postFormData(url, ctx.jar, data.request.formData, {})).then(parseAndCheckLogin(ctx, defaultFuncs, retryCount));
-                else return bluebird.delay(retryTime).then(() => defaultFuncs.post(url, ctx.jar, data.request.formData)).then(parseAndCheckLogin(ctx, defaultFuncs, retryCount));
+                // FIX v1.1.0: standard POST requests use data.request.form, not formData.
+                // formData is only set for multipart/form-data uploads. Sending an empty
+                // body on retry caused silent failures for all non-upload 5xx retries.
+                var contentType = (data.request.headers && data.request.headers["Content-Type"]) || "";
+                if (contentType.split(";")[0].trim() === "multipart/form-data") {
+                    return bluebird.delay(retryTime)
+                        .then(function() { return defaultFuncs.postFormData(url, ctx.jar, data.request.formData, {}); })
+                        .then(parseAndCheckLogin(ctx, defaultFuncs, retryCount));
+                } else {
+                    var retryBody = data.request.form || data.request.formData || {};
+                    return bluebird.delay(retryTime)
+                        .then(function() { return defaultFuncs.post(url, ctx.jar, retryBody); })
+                        .then(parseAndCheckLogin(ctx, defaultFuncs, retryCount));
+                }
             }
             if (data.statusCode !== 200) throw new Error("parseAndCheckLogin got status code: " + data.statusCode + ". Bailing out of trying to parse response.");
 

package/src/data/getThreadInfo.json

@@ -1 +0,0 @@
-[]